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Abstract 

The Vista project has centered on the use 
of decision-theoretic approaches for manag- 
ing the display of critical information rele- 
vant to real-time operations decisions. The 
Vista-I project originally developed a proto- 
type of these approaches for managing flight 
control displays in the Space Shuttle Mis- 
sion Control Center (MCC). The follow-on 
Vista-II project integrated these approaches 
in a workstation program which currently is 
being certified for use in the MCC. To our 
knowledge, this will be the first application of 
automated decision-theoretic reasoning tech- 
niques for real-time spacecraft operations. 

We shall describe the development and ca- 
pabilities of the Vista-II system, and provide 
an overview of the use of decision-theoretic 
reasoning techniques to the problems of man- 
aging the complexity of flight controller dis- 
plays. We discuss the relevance of the Vista 
techniques within the MCC decision-making 
environment, focusing on the problems of de- 
tecting and diagnosing spacecraft electrome- 


chanical subsystem component failures with 
limited information, and the problem of de- 
termining what control actions should be 
taken in high-stakes, time-critical situations 
in response to a diagnosis performed under 
uncertainty. Finally, we shall outline our cur- 
rent research directions for follow-on projects. 

1 Introduction 

The Vista project is a collaborative research 
and development effort between the Palo Alto 
Laboratory of the Rockwell Science Center, 
the Rockwell Space Operations Company, 
and NAS A/ Johnson Space Center to develop 
techniques for reducing the cognitive load on 
operators responsible for monitoring and con- 
trolling complex physical systems. In partic- 
ular, the project has centered on the use of 
decision-theoretic approaches for generating 
diagnostic assistance and for directing com- 
puter programs to display the most relevant 
information in a decision context. 

Last year, we developed and demonstrated 
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a prototype Vista- 1 decision-support and dis- 
play-management system for Space Shuttle 
Orbital Maneuvering System (OMS) burn 
monitoring and control activities. This proto- 
type system provides propulsion system flight 
controllers with diagnostic decision support 
by reasoning under uncertainty about alter- 
native problems, and by prioritizing them ac- 
cording to probability and criticality [1]. 

This Vista-I prototype stimulated efforts 
to continue this work by extending the rea- 
soning models and porting the techniques 
to MCC-class workstations, culminating with 
certification of the software for mission op- 
erations. To accomplish these efforts, the 
Vista team this year developed the Vista-II 
system. This system improves the Vista-I 
uncertainty models, supplements them with 
utility models, and captures the prototyped 
display-management features and techniques 
within an X-windows-based workstation pro- 
gram connected to the MCC telemetry data 
streams. The resulting program currently is 
undergoing final development and verification 
and validation testing prior to certification. 

2 Description 

The proper management of uncertainty in 
decision-making is critically important in 
high-risk operations endeavors like manned 
space flight. The Space Shuttle OMS 
performs many critical maneuvers (com- 
monly called burns ) during every mission, 
including orbit insertion and deorbit, ren- 
dezvous target phasing and orbital plane ad- 
justments, deployed-satellite and collision- 
avoidance separations, and contingency pro- 
pellant dumps. Therefore, it is vitally impor- 
tant that correct OMS diagnoses and opera- 
tions decisions be made promptly when sub- 
system faults occur during these maneuvers. 

The set of possible faults is known a priori , 
as are the valid responses to any combination 


of these failures. Since the OMS subsystem 
is well-transduced, the fault detection and 
diagnosis tasks are rather straightforward 
for an experienced flight controller; a less- 
experienced flight controller, however, may 
have a bit more uncertainty about fault sig- 
natures and correct response actions. How- 
ever, any flight controller faces significantly 
more difficult decision-making tasks when a 
prior failure of the spacecraft instrumenta- 
tion or data processing subsystems has ren- 
dered many of the primary OMS sensors inop- 
erative. Our program-embedded uncertainty 
models handle this often-encountered situa- 
tion by using whatever information is avail- 
able in the current situation, including sec- 
ondary sensors and prior probabilities. More- 
over, prior problems within the OMS subsys- 
tem may increase the difficulty of diagnosing 
multiple faults; the uncertainty models han- 
dle these situations in an elegant manner be- 
cause they calculate the probability distribu- 
tion over all faults. 

In Vista applications, we use uncertainty 
models to calculate the probability distribu- 
tions over the set of possible faults based on 
observed sensor data. We use these proba- 
bility distributions in conjunction with util- 
ity models to determine which course of ac- 
tion to recommend. Both of these mod- 
els affect the automated selection of adap- 
tive displays which the program provides to 
flight controllers for making the final diag- 
nosis and response decisions. Sections 2.1 
and 2.2 describe the uncertainty and utility 
models, respectively, and section 3 describes 
the displays and display-management tech- 
niques we’ve built into the Vista-II system. 

2.1 Uncertainty Model 

Automated reasoning systems often require 
representations of uncertainty about the 
world. These models often employ Bayesian 
inferencing techniques to calculate condi- 
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tional probabilities over a collection of hy- 
potheses given some evidence. They are es- 
pecially applicable to fault detection and di- 
agnosis problem domains in which multiple 
faults may occur or in which only a lim- 
ited amount of evidence is available. Vista 
systems employ these models within larger 
decision-theoretic models representing uncer- 
tainty and utility in decision-making pro- 
cesses. In Vista systems we apply these un- 
certainty models to the usual problems of 
fault detection and diagnosis, but we also 
apply them to the problem of automatically 
controlling the presentation of information to 
the user given uncertainty about the world. 

Vista systems use belief network mod- 
els to calculate the probability distributions 
over a set of possible faults for the OMS 
rocket engines and their associated propel- 
lant distribution systems and sensors. Be- 
lief networks are computational models which 
represent probabilistic influences among ob- 
servations (evidence) and possible explana- 
tions for these observations (conclusions or 
diagnoses). 1 In the OMS burn monitoring 
and control program specifically, we use be- 
lief networks to represent the probabilistic 
influences among telemetered readings from 
OMS pressure, temperature, quantity, and 
valve position sensors against a collection of 
possible faults or explanations which best de- 
scribe these observations. Figure 1 depicts 
a compact representation of the OMS burn 
network. 

Each belief network node contains condi- 
tional probabilities based on the conditional 
probabilities of its ancestors. We enter obser- 
vations from the world as certain evidence in 
certain leaf nodes. The inference engine prop- 
agates this evidence, using Bayes’ Rule, to all 
of the other nodes in the network. Extract- 
ing the resulting values of features within 

lr These belief networks, sometimes referred to as 
causal probability networks, are special forms of more 
general influence diagrams [2], 


designated fault nodes we obtain the condi- 
tional probability distribution for given ex- 
haustive set of faults. The program uses this 
fault probability distribution to update and 
manage displays and as input into the utility 
model. 

2.2 Utility Model 

For automated decisions about the best ac- 
tion to take under uncertainty, it is impor- 
tant to employ a representation of the value 
of alternative outcomes. Having access to the 
values of alternative outcomes allows for the 
selection of fault-response actions that have 
the highest expected utility. In the Vista-II 
system we employ a utility model to calculate 
the value of alternative outcomes based on 
the fault probability distribution. We display 
the distribution of these values over all of the 
alternative actions and assume that the flight 
controller will select the action with the max- 
imum expected utility. Section 3 describes 
these displays. 

The Vista-II utility model determines the 
value of alternative outcomes by calculat- 
ing the scalar product of the fault prob- 
ability distribution vector with an action- 
specific, utility-weighting parameter vector. 
We have experimented with various sets of 
weighting parameters. The set currently in 
place reflects a single-attribute model which 
describes the “right response” or “gut feel- 
ing” gleaned from experienced flight con- 
trollers. Essentially, these parameters re- 
flect the utility of selecting action A in re- 
sponse to each possible fault F. We have 
also constructed more specific multi-attribute 
utility models which can provide the weight- 
ing vector elements by performing a linear 
combination of decision attributes. These 
decision attributes include measures such as 
the importance of achieving maneuver targets 
(based on criticality), the risk of damage to 
spacecraft subsystem components, the per- 
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Figure 1: The belief network for OMS burn monitoring. Arcs represent probabilistic influ- 
ences between the nodes. Grayed titles denote evidence nodes. 
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formance capabilities available from backup 
systems, and the potential impact to mis- 
sion objectives. These multi-attribute util- 
ity models will be particularly important in 
distributed decision-making applications be- 
cause they provide a way to account for dis- 
parate degrees of contribution from indepen- 
dent subsystems toward common decision at- 
tributes. 

The model we have implemented in the 
Vista-II system provides the flight controller 
with a utility value distribution over four 
possible actions. These actions correspond 
to doing nothing (“continue”), terminating 
the burn (“stop”), or selecting a backup 
burn configuration (“engine-fail downmode” 
and “propellant-fail downmode”). Since the 
expected utility of executing these actions 
in response to a fault is context-dependent, 
the utility model employs a different set of 
weighting parameters for each user-selected 
context. Section 3 describes the mechanism 
by which the user can select the context. As 
the fault probability distribution changes ac- 
cording to the uncertainty model, the util- 
ity model changes the distribution over these 
possible actions and the program shows this 
distribution on the displays. 

3 Implementation 

The Vista-II application has been realized 
in a working program on MCC-class work- 
stations. These workstations run the Unix 
operating system and the X- Windows Sys- 
tem, and use the OSF /Motif window man- 
ager. The OMS burn monitoring program 
was written in the C language using the 
OSF/Motif programming style and widget set 
and the Hugin API inference engine for the 
belief networks. 2 Owing to our lack of access 

2 Unix is a trademark of AT&T. The X-Windows 
System is a trademark of Massachusetts Institute of 
Technology. OSF/Motif is a trademark of Open Soft- 


to a commercial product performing utility 
modeling, we have coded the utility models 
by hand. In this section we describe some 
of the implementation techniques, display- 
management philosophies, and design details 
found in this program. 

First, since the two OMS engines are func- 
tionally identical, but provide unique sets of 
sensor values, we use a copy of the belief net- 
work for each engine and change the engine- 
specific sensor value evidence nodes accord- 
ing to the appropriate sensor names and lo- 
cations. The belief network developer assigns 
to each fault given in the “fault” node an as- 
sociated “group” name, which we use to col- 
lect related faults into named groups in or- 
der to summarize these faults on a smaller 
display. The OMS burn monitoring program 
loads these two belief networks at run time. 
Once loaded and initialized, the program con- 
structs some of the Vista displays automati- 
cally based on the contents of the designated 
“fault” node in the network. The program 
then cyclically gathers telemetered sensor val- 
ues, translates analog values into qualitative 
values (such as low, nominal, or high), then 
installs these qualitative values as certain ev- 
idence in the sensor nodes. If the value of 
any evidence node has changed since the last 
data cycle, the program runs the belief net- 
work inference engine to compute the prob- 
ability distributions over all of the possible 
values in each of the other nodes. The pro- 
gram then uses these new probability distri- 
butions to update and select the appropriate 
displays. 

Next, we draw a distinction between two 
sorts of displays built into this program: fixed 
displays and adaptive displays. The fixed dis- 
plays essentially are conventional flight con- 
troller displays showing spacecraft subsystem 
configurations, current sensor values, internal 


ware Foundation, Inc. Hugin API is a trademark of 
Hugin Expert A/S. 
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Figure 2: Left OMS summary display. Only a small sampling of information about the Left 
OMS is available to the user from this display. 
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Figure 3i Left OMS detailed display. All of the Left 03VIS sensor and calculation data is 
available to the user from this display. 
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Figure 4: OMS burn program palette menu. The user may select any of the program’s 
displays from this menu, thereby overriding automatic controls over the presented displays. 
This menu contains pulldown menus for “n-of-many” selections and option menus for “one- 


of-many” (mutually exclusive) displays. 

computation results, mission status informa- 
tion, and so on. These displays are “fixed” 
because they’re compiled into the program. 
Some of the fixed displays pertain to various 
levels of “granularity” or detail; these range 
from showing an overview sampling or sum- 
mary of important information, to showing 
every bit of detailed information. In order 
to manage the “real estate” on the screen, 
and thereby manage the cognitive load on the 
user, the program employs the Vista mod- 
els to select which degree of detail is suitable 
for display: it chooses the summary displays 
when there isn’t much of interest in the cur- 
rent decision context from one series of dis- 
plays, but chooses the detailed displays when 
crucial information from these displays is nec- 
essary to make the best-informed decision. If 
necessary, the program will “shrink” the irrel- 
evant displays and “enlarge” the relevant dis- 
plays by selecting among the fixed displays in 
each series. Of course, there may be some in- 
formation overlap in each level of granularity. 
Figures 2 and 3 show a summary and detailed 
display for the Left OMS subsystem. Since 
we allow the user to override any of these au- 
tomatic display selections, the program also 
provides a “palette” menu from which to se- 
lect any of the displays made available by the 
program. Figure 4 shows the palette for the 
OMS burn program. 

The adaptive displays provide the users in- 
sight into the probability and utility distri- 


butions calculated by the inference engine. 
These displays are “adaptive” in the sense 
that the program builds them automatically, 
based on external information, so that var- 
ious configurations of the displays may be 
used for different stages of development or by 
different users. Specifically, the program con- 
structs these displays from information con- 
tained within the belief networks; since there 
are a pair of belief networks for any com- 
plete OMS burn model, the program actu- 
ally builds two sets of displays. First, the 
program builds a “detailed” diagnosis display 
which lists all of the possible faults provided 
by the model. We use a histogram repre- 
sentation to convey the probability distribu- 
tion over these faults; initially, the distribu- 
tion corresponds to. the a priori probabilities 
of occurrence. Second, the program builds a 
“summary” diagnosis display which lists all 
of the fault groups encountered in the fault 
list. It is assumed that each possible fault is 
a member of one and only one fault group. 
Again, we use a histogram representation to 
convey the probability distribution over the 
fault groups. As the program acquires and 
processes telemetry data, the inference engine 
will determine new probability distributions 
which the program will present to the user 
by changing the magnitudes of the appropri- 
ate graph elements. Figures 5 and 6 show 
examples of these displays. These two dis- 
plays represent the “granularity” offered into 
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Figure 5: A “detailed” diagnosis display. Each entry in the histogram represents the relative 
probability for the named fault. 



Figure 6: A “summary” diagnosis display. Each entry in the histogram represents the 
summation of the probabilities for all faults in the named group. 
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the diagnosis information. Since the sum- 
mary diagnosis display consumes less screen 
space than the detailed diagnosis display, it 
is meant to be used as the primary diagnosis 
display when the probability of any fault is 
low. The program will automatically replace 
the summary display with the detailed dis- 
play when the probability of any fault exceeds 
some threshold. We shall describe below a 
built-in feature which enables the user to ad- 
just this threshold. To override these auto- 
matic controls, the displays also provide con- 
venient push-buttons to increase or decrease 
granularity. There is also a push-button to 
invoke the “setup” dialog, which we describe 
below. 

Another adaptive display is the action- 
selection display. Since the belief networks do 
not contain information for the utility mod- 
els, the program builds this display based 
on information contained in a user-controlled 
file. This file contains certain actions and 
utility model parameters necessary to build 
the display. Once again, there is one action- 
selection display for each OMS. Figure 7 
shows the action-selection display for the 
OMS burn monitoring program. Since the 
number of actions is small in this application, 
there is only one level of granularity among 
the action-selection displays. 

The “setup” dialog box provides the user 
with some control over the behavior of the 
inference and display-management functions 
(see figure 8). The three option menus pro- 
vide the user with a mechanism for select- 
ing the context of the OMS burn, such as 
whether the burn is critical, whether a mini- 
mum burn target must be satisfied, and what 
performance capabilities remain in redundant 
systems in the event of a failure of the pri- 
mary system. The configuration of these 
menus affects the parameters used by the 
utility model. The “auto-display threshold” 
slider bar enables the user to select the fault 
probability value above which the program 


will automatically present the detailed diag- 
nosis display (for all faults other than “ok”). 
The “auto-freeze threshold” slider bar en- 
ables the user to select the fault probability 
above which the program will cease to up- 
date the probability and utility distributions 
and displays. This feature disables updates 
to faults which manifest themselves in a dy- 
namic fashion, presenting evidence convinc- 
ingly initially (with high probability), then 
appearing to change into a different signa- 
ture. Since the initial signature best rep- 
resents the real problem, we may choose to 
disable further calculations after exceeding a 
certain confidence threshold. 

Finally, adopting the Vista philosophy on 
screen real-estate management, the OMS 
burn program can control the placement of 
most of these displays automatically. For ex- 
ample, the program will place the Left and 
Right OMS summary and detailed displays 
adjacent to each other if a companion dis- 
play is already visible on the screen. It will 
also substitute the mutually exclusive dis- 
plays at the same screen location. These 
automatic placements override the window 
manager’s controls over window placement. 
If a companion display is not visible, the 
program will defer placement to the window 
manager, which then employs the user’s de- 
fault geometry settings or interactive place- 
ment resources. These automatic controls 
provide convenient display- management tech- 
niques which minimize distraction of the user 
during crucial decision-making contexts. 

The OMS burn belief network and util- 
ity models capture a tremendous amount of 
flight controller expertise. The belief net- 
works were developed in direct consultation 
with flight controllers, and accurately repre- 
sent the probabilistic reasoning performed by 
these flight controllers during real-time MCC 
operations. The a priori probabilities for the 
uncertainty models and the utility parame- 
ters for the utility models were derived from 
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Figure 7: An action-selection display. Each entry in the histogram represents the relative 
utility for the named action in the current burn context. 
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Figure 8: The OMS burn program “setup” dialog box. Slider bars enable the user to set 
thresholds for display-management functions. Option menus enable the user to establish the 
burn context for the utility model. 
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the results of surveys of all of the flight con- 
trollers responsible for OMS burn monitoring. 

We have found that these model parameters 
have worked extremely well during rigorous 
tests of this new program. 

4 Future Work 

The Vista-I and Vista-II systems have been 
very successful, particularly in demonstrat- 
ing the usefulness of these decision-theoretic 
approaches to decision-making and display- 
management in real-time operations. These 
successes have generated many interesting 
ideas we intend to pursue as we enhance the 
models and reasoning techniques. Many of 
these ideas will be pursued during next year’s 
Vista-III project. 

Using collaborating Vista models, we are 
experimenting with a distributed expert sys- 
tem approach to group decision-making ap- 
plications. Using the information sharing 
protocol developed at JSC [4], we distribute 
the probability and utility distribution results 
from various Vista models across a network to 
other flight controllers whose systems may be 
affected by the operations of another system. 
Such a multi-agent application is especially 
useful for prioritizing a serial list of actions 
to be forwarded to the astronauts. This ap- 
proach is also interesting for the deployment [2] 
of adaptive multi-attribute utility models. 

We are also experimenting with the inte- 
gration of empirical sensor importance mea- 
surements derived by the selective monitor- 
ing (SELMON) project at the NASA Jet 
Propulsion Laboratory (JPL) [5]. These mea- 
surements often provide additional intuitive 
representations of sensor observations as evi- 
dence for the sensor nodes in the belief net- 
works, particularly when the dynamic behav- 
ior of a sensor is important information. 

A focus on sensor importance can also be [4] 
made from a strictly probabilistic or statis- 


tical standpoint. One interesting application 
of these techniques lies in determining the di- 
minished confidence in the latest sensor read- 
ing over time. Another similar application 
can determine the information content of a 
particular display, enabling the program to 
suggest a fixation on that display if it isn’t 
currently visible. 

Finally, we are developing new implemen- 
tation techniques to facilitate the integra- 
tion of uncertainty models within worksta- 
tion programs. These implementation tech- 
niques include display-management protocols 
interacting with the window manager, new 
frameworks of interacting objects to facili- 
tate display construction, and possibly new 
X-compatible widgets which hide all of these 
implementation details from the programmer. 
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